Confidentiality in the Treatment of Substance Use Disorders

Covered entities are not required to provide clients with an account of PHI disclosure in which of the following circumstances? -When the disclosures are related to treatment, payment, or healthcare operations -When the client has not been seen by the covered entity in more than 3 years -When the covered entity mails a billing statement to the wrong address -When the covered entity is not subject to HIPAA or 42 CFR Part 2

When the disclosures are related to treatment, payment, or healthcare operations

Information a client receives about how their PHI may be disclosed must be: -Read to the client before they sign -Written in plain language -Written exactly as they provided in the statute -Reviewed with the client by the provider

Written in plain language

Which of the following would be considered client identifying information under CFR 42 Part 2? -A number assigned to a client for internal use only -A number assigned to a client that includes their driver's license number -The first name of the client's mother -A client's favorite color or sports team

A number assigned to a client that includes their driver's license number

A person overhearing staff discussing lab results in a joint treatment area is an example of: -An incidental disclosure -A HIPAA violation -A client right violation -A minimum necessary disclosure

An incidental disclosure

The HIPAA Privacy Rule permits disclosure of information related to treatment, healthcare operations, and ______ without client consent. -Diagnosis -Payment -Medications -Prognosis

Payment

Which of the following summarizes the intent of 42 CFR Part 2? -To provide additional measures of security to HIPAA's Security Rule. -To provide additional protections for individuals seeking treatment for a substance use disorder. -To provide civil and criminal penalties for programs that violate the Privacy Rule under HIPAA. -To provide clients seeking general healthcare with extra security measures over their personal health information.

To provide additional protections for individuals seeking treatment for a substance use disorder.

. During a group therapy session, a client in a behavioral health facility discusses how he hit and slapped his elderly grandmother while he lived with her and while he was using alcohol. He expresses his concern that he will do it again given his history with his grandmother. The therapist submits a report of suspected elder abuse to law enforcement. Which of the following regulations considers this a permissible disclosure? -HIPAA -42 CFR Part 2 -Both HIPAA and 42 CFR Part 2 -Neither HIPAA nor 42 CFR Part 2

HIPAA

Melanie is releasing information about John to a future medical care provider. The information disclosed is related strictly to X-rays and endoscopy results. Which confidentiality rules does Melanie need to abide by? -The Freedom of Information Act -HIPAA and 42 CFR Part 2 -42 CFR Part 2 -HIPAA

HIPAA

Which of the following is a challenge for providers related to integrated healthcare and electronic health records? -Taking time from client care to ask for written consent -Having to read the disclosure consent form to clients -Getting multiple providers to agree to a unified consent form -Lacking appropriate systems to share information

Lacking appropriate systems to share information

Which of the following is a common client challenge related to integrated health settings and electronic health records? -Lacking knowledge about who has access to their health records -Lacking appropriate technology to provide required consent for disclosures -Having the disclosures written in legal verbiage and not in plain language -Having their substance use treatment information readily available to any medical provider

Lacking knowledge about who has access to their health records

When a crime is committed on the premises of a substance use treatment program, what information may be disclosed to law enforcement? -Relevant information about the victim -Relevant information about the perpetrator -Information about all clients and personnel affected by the crime -Disclosure of the entire record of any client at the scene of the crime

Relevant information about the perpetrator

True or False: Restrictions on disclosure do not apply to Qualified Service Organizations when information is needed by the organization to provide services to the program. True/False

T

Limiting the disclosure of PHI to the smallest amount of information needed to accomplish the purpose for which disclosure is sought is called: -The Privacy Rule -The Security Rule -The Minimum Necessary Rule -The Client's Right Rule

The Minimum Necessary Rule

Which of the following outlines what providers can and cannot do with a person's protected health information (PHI) under the Health Insurance Portability and Accountability Act? -The Privacy Rule -The Security Rule -The Health Information Technology for Economic and Clinical Health Act -The Freedom of Information Act

The Privacy Rule

Which of the following regulates the methods used to ensure the security of a person's PHI by systems that receive, maintain, or send PHI? -The Privacy Rule -The Security Rule -The Health Information Technology for Economic and Clinical Health Act -The Freedom of Information Act

The Security Rule

Which of the following could be a reason why a client is denied access to their health information? -Their information is currently being used as data in a research project -The information requested is considered to be psychotherapy notes -They submitted the request in writing instead of orally to their provider -The provider has not seen the client in more than 3 years

The information requested is considered to be psychotherapy notes

When conflicts occur between regulations related to permissible disclosures of a client's health information, which of the following is TRUE? -You should follow the regulation of the state in which you are practicing -You should follow the regulation that provides the client the most protection -You should follow the regulation that has the steepest penalties for breaching--You should follow the regulation that provides the most flexibility to your program

You should follow the regulation that provides the client the most protection

When an organization or individual is involved in an audit or evaluation, under 42 CFR Part 2, the organization or person must do which of the following? -Incinerate or otherwise properly dispose of the information once the audit or evaluation is over -Agree in writing that information will not be re-disclosed except under strict conditions -Provide a full report of the audit to any client who requests it -Notify the public immediately if they find any evidence of an information breach

Agree in writing that information will not be re-disclosed except under strict conditions

A person overhearing staff discussing lab results in a joint treatment area is an example of: An incidental disclosure -A HIPAA violation -A client right violation A minimum necessary disclosure

An incidental disclosure

Which option(s) permit program personnel to make disclosures to medical personnel, to the extent it meets a medical emergency, without a client's consent? -HIPAA -CFR 42 Part 2 -Both HIPAA and CFR 42 Part 2 -Neither HIPAA nor 42 CFR Part 2

Both HIPAA and CFR 42 Part 2

True or False: Client access to their own PHI cannot be restricted for any reason. True/False

F

If 42 CFR Part 2 applies, under what circumstances can law enforcement personnel question clients at a treatment facility? -If there has been a client crime on the program premises or a crime committed by a client against personnel -Only if the officers have a court order permitting questioning of the clients at the facility -If the facility had knowledge about the alleged crime before being informed by law enforcement -If the facility has a valid subpoena which specifically names the persons at the facility which they plan to question

If there has been a client crime on the program premises or a crime committed by a client against personnel

Which of the following statements is TRUE? -Individuals in treatment for SUD have less protection over their health information than what the HIPAA Security Rule provides. -Individuals in treatment for SUD have additional protections over their health information than what the HIPAA Security Rule provides. -Individuals in treatment for SUD have no reasonable right to protection over their health information. -Individuals in treatment for SUD can waive their right to have their health information protected under the HIPAA Security Rule.

Individuals in treatment for SUD have additional protections over their health information than what the HIPAA Security Rule provides.

Which of the following statements is TRUE? Individuals in treatment for SUD have less protection over their health information than what the HIPAA Security Rule provides. -Individuals in treatment for SUD have additional protections over their health information than what the HIPAA Security Rule provides. -Individuals in treatment for SUD have no reasonable right to protection over their health information. -Individuals in treatment for SUD can waive their right to have their health information protected under the HIPAA Security Rule.

Individuals in treatment for SUD have additional protections over their health information than what the HIPAA Security Rule provides.

Under 42 CFR Part 2, which of the following statements is TRUE? -Information can be re-disclosed for any purpose -Information can only be re-disclosed with written consent from the client -Information can be re-disclosed upon approval of the primary provider -Information cannot be re-disclosed under any circumstance

Information can only be re-disclosed with written consent from the client